From nobody Fri Dec 19 21:01:21 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DDDD428030B for ; Tue, 27 May 2025 16:54:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748364865; cv=none; b=f5zcp8wrXOA24wrvycKsoZ54DK0JsCQyKlefEqHOiiigEc8qxZFEyAshweym4JHDyNDIdD+4x4K/X4+iooVODVlNENbZWq9+Ail+99SXaqUtkyMNNTXCaj+YO4DG4wm3a2ytxYaMvLcyYcMLxmC29SpIlJNbBAxVNHP+EJj8v1s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748364865; c=relaxed/simple; bh=faAyvJ7qDtqhrtzmWY1tEA3zcdDuNWETrdnIodiVYnE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=X83V/cwcJJHftK1Jt56jyAiVcWR+9TjsmSk38YnVastIdhgj4B3pSIQppFBcIly/xjlQ2w03iankVdsv9Bzxsk9pLM+hpyg3UeDTE5FigtrTCcd8iseC9ZwjJqrwvocPrSk5oEwz7kk+A5EDWshjEVHIxoXei+x1RPmBh2c/9dU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=UcyIVsIc; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="UcyIVsIc" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1748364862; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=0Azkfo/3THlNlvSSf9IUNcPc6ss/iGQ5ilgF0zN91Xs=; b=UcyIVsIcUZXcdvuhuKqcgpTpHUbIoDQAXcR/yBD0Tu29RHnsrN6/vaipqKrsbZKQh3F0tP kQ4Xz5CmFsebMMT/wAGc1PUt7i9qUzhGFNmzmtCtsjjp3H18lasZZKsB+p9oNqlX7GsZ/t F38U6gXQGYD9UEfNTz8eNl5FY8zLBFU= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-616-Sqm02QwTM5e5RmxdKn-jFg-1; Tue, 27 May 2025 12:54:19 -0400 X-MC-Unique: Sqm02QwTM5e5RmxdKn-jFg-1 X-Mimecast-MFC-AGG-ID: Sqm02QwTM5e5RmxdKn-jFg_1748364858 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id AAEA419560BC; Tue, 27 May 2025 16:54:17 +0000 (UTC) Received: from fedora (unknown [10.44.34.177]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with SMTP id 3CF3930001B0; Tue, 27 May 2025 16:54:14 +0000 (UTC) Received: by fedora (sSMTP sendmail emulation); Tue, 27 May 2025 18:54:12 +0200 From: "Jerome Marchand" To: bpf@vger.kernel.org Cc: Martin KaFai Lau , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , linux-kernel@vger.kernel.org, Jerome Marchand Subject: [PATCH] bpf: Specify access type of bpf_sysctl_get_name args Date: Tue, 27 May 2025 18:54:12 +0200 Message-ID: <20250527165412.533335-1-jmarchan@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" The second argument of bpf_sysctl_get_name() helper is a pointer to a buffer that is being written to. However that isn't specify in the prototype. Until commit 37cce22dbd51a ("bpf: verifier: Refactor helper access type tracking"), all helper accesses were considered as a possible write access by the verifier, so no big harm was done. However, since then, the verifier might make wrong asssumption about the content of that address which might lead it to make faulty optimizations (such as removing code that was wrongly labeled dead). This is what happens in test_sysctl selftest to the tests related to sysctl_get_name. Correctly mark the second argument of bpf_sysctl_get_name() as ARG_PTR_TO_UNINIT_MEM. Signed-off-by: Jerome Marchand --- kernel/bpf/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 84f58f3d028a3..09c02a592d24a 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -2104,7 +2104,7 @@ static const struct bpf_func_proto bpf_sysctl_get_nam= e_proto =3D { .gpl_only =3D false, .ret_type =3D RET_INTEGER, .arg1_type =3D ARG_PTR_TO_CTX, - .arg2_type =3D ARG_PTR_TO_MEM, + .arg2_type =3D ARG_PTR_TO_UNINIT_MEM, .arg3_type =3D ARG_CONST_SIZE, .arg4_type =3D ARG_ANYTHING, }; --=20 2.49.0